In practice, we use ResNet-50 [1]} integrated with graph convolutional network [2]} to classify fundus images, the multi-scale booster framework [3]} to detect artefact, and U-Net [4]} to segment infected lung regions. The proposed method is compared to other adversarial attack methods including FGSM [5]}, PGD [6]}, DeepFool [7]}, and DAG [8]}. The comparisons are made by adding these generated perturbations on the input images for decreased performance observation. For evaluation metrics, we use mean accuracy for medical image classification, IoU and mean Average Precision (mAP) for detection, and mean accuracy and Jaccard index for segmentation. During perturbation generation, we set \(\epsilon \)  as \(0.05\) , \(0.01\) , \(5\times 10^{-5}\)  for lung segmentation, artefact detection and diabetic retinopathy grading respectively. We stop at the 10-th iteration for all the attack methods. The \(\alpha \)  in Eq. REF  is set as 1. We provide more results including using different Gaussian kernels \(W\)  and show the pseudo code in the supplementary files. Our implementation will be made available to the public.
<TABLE><TABLE>